Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01-11-2023 03:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.85c76584a43e616210ec95497ef10f80.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.85c76584a43e616210ec95497ef10f80.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.85c76584a43e616210ec95497ef10f80.exe
-
Size
72KB
-
MD5
85c76584a43e616210ec95497ef10f80
-
SHA1
13f8fa9c043fb4c05fc46c795373866f7dcf4b9b
-
SHA256
46f9d7d9716e66a5b7ed4600d5b0ffcdf9441322130558833af8879c34973245
-
SHA512
f55daa86a0186936f14ee9c53d8ff84b0bb6016820f0aadf596b46ed43830df222011e24cbb34cb5c460f85ed9ac139b0e9e3ddcdabdafaa46425fdc76a730b7
-
SSDEEP
768:ehSksandb4GgyMsp4hyYtoVxYGm1ZAfPsED3VK2+ZtyOjgO4r9vFAg2rql:eTsGpehyYtkYvnEYTjipvF2Y
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 832 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2960 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2300 cmd.exe 2300 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEAS.85c76584a43e616210ec95497ef10f80.execmd.execmd.execmd.exedescription pid process target process PID 2332 wrote to memory of 2752 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 2752 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 2752 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 2752 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 2300 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 2300 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 2300 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 2300 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 832 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 832 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 832 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2332 wrote to memory of 832 2332 NEAS.85c76584a43e616210ec95497ef10f80.exe cmd.exe PID 2752 wrote to memory of 2848 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2848 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2848 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2848 2752 cmd.exe reg.exe PID 2300 wrote to memory of 2960 2300 cmd.exe MediaCenter.exe PID 2300 wrote to memory of 2960 2300 cmd.exe MediaCenter.exe PID 2300 wrote to memory of 2960 2300 cmd.exe MediaCenter.exe PID 2300 wrote to memory of 2960 2300 cmd.exe MediaCenter.exe PID 832 wrote to memory of 2716 832 cmd.exe PING.EXE PID 832 wrote to memory of 2716 832 cmd.exe PING.EXE PID 832 wrote to memory of 2716 832 cmd.exe PING.EXE PID 832 wrote to memory of 2716 832 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.85c76584a43e616210ec95497ef10f80.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.85c76584a43e616210ec95497ef10f80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.85c76584a43e616210ec95497ef10f80.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD586910687ece4b5603570f7c8875bf269
SHA1924c20e235849aa20413fe504e06b47829348ca5
SHA2569aa763a710fc996c39b7e5aef57b3882d05457602288e946d4929a3b8f4dd6ca
SHA512b414467755046214e7c6684919c05278500e44547737b85fe70bc629a496e53be06d0bad82b8e02e700a230e08bca3f4f071b89aebb46c0f6fcd9b3333157407
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD586910687ece4b5603570f7c8875bf269
SHA1924c20e235849aa20413fe504e06b47829348ca5
SHA2569aa763a710fc996c39b7e5aef57b3882d05457602288e946d4929a3b8f4dd6ca
SHA512b414467755046214e7c6684919c05278500e44547737b85fe70bc629a496e53be06d0bad82b8e02e700a230e08bca3f4f071b89aebb46c0f6fcd9b3333157407
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD586910687ece4b5603570f7c8875bf269
SHA1924c20e235849aa20413fe504e06b47829348ca5
SHA2569aa763a710fc996c39b7e5aef57b3882d05457602288e946d4929a3b8f4dd6ca
SHA512b414467755046214e7c6684919c05278500e44547737b85fe70bc629a496e53be06d0bad82b8e02e700a230e08bca3f4f071b89aebb46c0f6fcd9b3333157407
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD586910687ece4b5603570f7c8875bf269
SHA1924c20e235849aa20413fe504e06b47829348ca5
SHA2569aa763a710fc996c39b7e5aef57b3882d05457602288e946d4929a3b8f4dd6ca
SHA512b414467755046214e7c6684919c05278500e44547737b85fe70bc629a496e53be06d0bad82b8e02e700a230e08bca3f4f071b89aebb46c0f6fcd9b3333157407
-
memory/2300-7-0x0000000000130000-0x000000000013C000-memory.dmpFilesize
48KB
-
memory/2300-11-0x0000000000130000-0x000000000013C000-memory.dmpFilesize
48KB
-
memory/2332-0-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2332-1-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2332-3-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2960-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2960-10-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB